Fail2ban

This article is a Draft. Help us to complete it.

wikipedia:Fail2ban (2004, Python) is an intrusion prevention software framework that protects computer servers from brute-force attacks

The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server.

 fail2ban-client status sshd

fail2ban-client -t
OK: configuration test is successful

Binaries

fail2ban-client
fail2ban-regex
fail2ban-server
fail2ban-testcases
fail2ban-python

cat /etc/fail2ban/fail2ban.conf | grep -v "#" | grep .
[DEFAULT]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 1d
dbmaxmatches = 10
[Definition]
[Thread]

Related terms

• /var/log/auth.log
• iptables
• RdpGuard
• sshd logs: Failed password for
• Dictionary attack
• OSSEC
• shorewall

Activities

• Read ArchLinux fail2ban article

See also

• IDS, HIDS: snort, fail2ban, RdpGuard, suricata, OSSEC, Wazuh, Palo Alto WildFire, Malware analysis
• SIEM: Splunk, Elastic SIEM, graylog, IBM QRadar, SIEM Magic Quadrant, Micro Focus ArcSight, SentinelOne
• Mail, SMTP, submission, SMTPS, POP, IMAP, StartTLS, Exim, Postfix, IRedMail, Fail2ban, Dovecot, Roundcube, DKIM, SPF, DMARC, MX, ssmtp, mailx